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Introduction 

1. My name is Laurence D. Lieb. I am the President of Tyger Forensics Inc., which 
provides, among other things, computer forensics and electronic discovery services to litigation 
attorneys and their clients. I am a Magnet Forensics Certified Examiner and a Cellebrite Certified 
BlackLight Examiner. I am also a licensed private investigator in the State of Michigan. 

Zz To obtain my certification as a Magnet Forensics Certified Examiner, I undertook 
online training led by Magnet Forensics. To remain certified, I am required, from time to time, to 
retrain and pass certification examinations for new software versions. A true and exact copy of my 
certification is attached as part of Exhibit A and incorporated by reference. 

oh To obtain my certification as a Cellebrite Certified BlackLight Examiner, I 
undertook online training led by Cellebrite. To remain certified, I am required, from time to time, 
to retrain and pass certification examinations for new software versions. A true and exact copy of my 
certification 1s attached as part of Exhibit B and incorporated by reference. 

A. I counsel and assist clients in the preservation, extraction, and analysis of electronic 
data, using industry-standard practices, based on evidence personally analyzed, and form expert 
opinions regarding human interaction with electronic data from smartphones, computers, cloud- 
based sources, and a myriad of other electronic devices. I have been retained for this type of work 
around the country by numerous clients, as described in my curriculum vitae, which 1s attached as 
Exhibit C. 

3. I have been retained by Ecolab, and its counsel, Fisher & Phillips LLP, to provide 
expert opinions regarding my forensic analysis of a data loss prevention system report and 
documents in the litigation titled ECOLAB Inc., and NALCO COMPANY, LLC d/b/a Nalco 
Water, an Ecolab Company and/or Nalco Water, Plaintiffs, ve ANTHONY RIDLEY, and 
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CHEMTREAT, INC, pending in the United States District Court, Eastern District of Tennessee, 
Chattanooga Division (the “Litigation”). 

6. My hourly rate for this matter varies by task as follows: for pure forensic analysis & 
reporting, $350 per hour; for written declarations, depositions, and other sworn testimony, $450 per 
hour. My fees are unrelated to the outcome of the Litigation. My curriculum vitae, attached as 
Exhibit C, lists my testimonial experience for the last four years and all my publications for the last 
ten years. 

7. This rebuttal report 1s based on my personal knowledge, experience, and expertise 
in the area of forensic analysis of electronic devices. It is also based on my review of the Expert 
Report of James Vaughn (“Vaughn”, “Vaughn Report”) dated (02.21.2023, and ChemTreat’s 
CrowdStrike report. 

8. It is my understanding that the plaintiffs in this case are Ecolab, Inc. and Nalco 
Company, LLC (“Plaintiffs” or “Ecolab”), and the defendants are ChemTreat, Inc. (“ChemTreat”) 
and a former employee of Plaintiff named Anthony Ridley (“Ridley”). The claims pleaded by the 
Plaintiff, include (1) theft of trade secrets in violation of the Defend Trade Secrets Act, (2) violation 
of the Tennessee Uniform Trade Secrets Act, (3) breach of contract, (4) breach of fiduciary duty of 
loyalty, (5) tortious interference with contractual relationships, (6) procurement of breach of contract, 
(7) unfair competition, and (8) civil conspiracy. Plaintiffs claim that Ridley misappropriated trade 
secrets and other confidential information from Ecolab. 

9. I understand that discovery 1s ongoing in this Litigation. I reserve the right to render 
additional opinions, to supplement or amend the opinions in this report, and to provide additional 
grounds for those opinions based on my ongoing analysis of the materials provided to me or as may 
be required by events that occur during the course of this Litigation, including but not limited to 
responding to or analyzing positions taken by Ridley or his experts. 
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Sources of Evidence Analyzed by Vaughn 


10. In the Vaughn Report page 8, paragraph A, “Key Sources of Electronically Stored 
Information”, Vaughn describes the entire universe of evidence he searched and analyzed including 
(1) a Microsoft cloud-based document storage platform named OneDrive; (2) a ChemTreat-issued 
email account that stores emails sent or received by Mr. Ridley; and (3) information regarding Mr. 
Ridley’s activities derived from an enterprise level data protection software program named 
CrowdStrike. 

11. In page 9, paragraph 1, Vaughn concludes that “Based on more than 20 years of 
experience as a forensic investigator, this investigation was a reasonable search of these locations and 
would allow me to determine what, if anything, Mr. Ridley had distributed within ChemTreat’s 
Systems or to others with whom I understand he interacted at ChemTreat using ChemTreat’s 
Systems.” I respectfully disagree. 

12. As stated in my Lieb Report, the Ecolab Digital Guardian report recorded the fact 
that Ridley had uploaded multiple Ecolab files to Ridley’s own personal Microsoft OneDrive 
account while employed at Ecolab, and then later accessed his personal OneDrive account using his 
now wiped ChemTreat computer while employed at ChemTreat. In fact, the ChemTreat 
CrowdStrike report revealed the fact that Ridley had accessed his own personal Microsoft account 
within seconds of accessing Arnold’s Air Force Base documents stored within Ridley’s ChemTreat 
OneDrive account. 

13. Therefore, searches for the exfiltrated Ecolab file names alone, as performed by 
Vaughn, will not reveal the Ecolab information Ridley accessed using his now wiped ChemTreat 
computer while simultaneously interacting with ChemTreat files stored in folders named after the 


same customer files Ridley exfiltrated from Ecolab. In my opinion, analysis of the actual content of 
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all files Ridley created while employed at ChemTreat is required in order to identify the specific 
exfiltrated Ecolab information Ridley used while employed at ChemTreat. 

14. In my opinion, forensic analysis of Ridley’s now wiped ChemTreat computer could 
certainly have identified at a minimum the Ecolab file names Ridley was accessing while employed 
at ChemTreat for use at ChemTreat. Unfortunately, because ChemTreat’s CrowdStrike tool is not 
a data loss prevention tool, and thus did not record all the file names Ridley interacted with both 
from his personal Microsoft account and within his ChemTreat OneDrive account or ChemTreat 
email account, simple searches for the exfiltrated Ecolab file names alone will not uncover the Ecolab 
information Ridley used while employed at ChemTreat. The wiping of the ChemTreat laptop 
assigned to Ridley therefore creates a significant evidentiary hole that cannot be filled by any other 
source and greatly impacts the forensic analysis in this case. 

15. The ChemTreat Crowdstrike tool, as described in my Lieb Report, 1s not a data loss 
prevention tool. In fact, the term “data loss prevention” or the industry standard acronym “DLP” 
does not appear anywhere in CrowdStrike’s website. CrowdStnke positions its tools as incident 
response and malware security software, designed to identify and deal with threats from hackers. In 


contrast, on the very first page of Digital Guardian’s website, https://www.digitalguardian.com/, the 


maker of Digital Guardian, Fortra, describes Digital Guardian as “The Industry’s Only SaaS Solution 
for Enterprise DLP.” 

16. Digital Guardian’s report, provided to Vaughn, recorded many critical categories of 
information which is not captured nor included in the CrowdStrike report due to the fact that the 
Digital Guardian report is a true data loss prevention tool. 

17. For example, the Digital Guardian report recorded the make, model and serial 
number of the Ridley Ecolab laptop’s internal hard drive Ridley used to exfiltrate thousands of 
Ecolab files. The CrowdStrike report, in contrast, does not list the internal make, model or serial 
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number of the now wiped ChemTreat laptop’s internal hard drive, nor does the CrowdStrike report 
include all the makes, models and serial numbers of all USB drives connected to the laptop. The 
same 1s true of the USB devices identified on pages 12 and 13 of the Vaughn report. 

LS. In the Vaughn Report, page 35, second paragraph, Vaughn states that “Based on 
those validation procedures, I was able to confirm that CrowdStnke logs all interactions a subject 
laptop has with any documents accessed from an external device, and retains that information even 
after the subject laptop 1s reformatted.” However, nowhere in the Vaughn Report does Vaughn 
address the fact that the CrowdStrike report did not record the names of files being downloaded or 
uploaded to and from Ridley’s personal Microsoft OneDrive account, an account we know stored 
exfiltrated Ecolab files. As the Vaughn Report states, CrowdStrike does in fact record files being 
copied from an external USB drive to a ChemTreat computer. However, CrowdStrike does not 
record individual files being opened, accessed, saved as PDF files, or printed from external USB 
drives plugged into ChemTreat computers; evidence of such activity would have been recorded on 
the now wiped ChemTreat laptop. 

19. | ChemTreat themselves identified the fact that Ridley had sent an Ecolab file from 
Ridley’s personal Microsoft account to Ridley’s ChemTreat email account; however none of the 
aforementioned activity was recorded or captured in the CrowdStrike report because the 
CrowdStrike report is not a data loss prevention tool and is thus not designed to record such 
activity. 

The Lexar USB Drive 

20. | Vaughn’s report references a Lexar USB Flash Drive, Serial Number 
56261F6B34AF1760 but omits any reference to Vaughn having run a file carving utility to recover 
any deleted files from this Lexar drive. File carving is an industry standard forensic practice which 
recovers deleted files from a device. 
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Two Missing USB Drives 


PAR On page 13 of the Vaughn report, Vaughn references Nalco files appearing in the 
CrowdStrike report and "hav(ing) been accessed from a USB device that CrowdStrike identified 
as ‘HarddiskVolumeS.’” Vaughn goes on to explain that “the last two documents listed above 
appear to have been accessed from another USB device that CrowdStrike identified as 
‘Harddisk Volume6.’” 

22. In layman’s terms, this means that Ridley used at least two different USB drives 
containing Ecolab files on his ChemTreat laptop. Vaughn identified seven different Ecolab files 
that Ridley accessed from these unknown USB drives. 

23. [reviewed the Digital Guardian report to look for these files. I found five out of 
seven of these files within the Digital Guardian report. In my opinion, this means that Ridley 
continued to have access to these five files that he downloaded from his Ecolab OneDrive account 
while employed at ChemTreat. This fact undermines Ridley’s claim that Ridley returned all 
Ecolab files to Ecolab upon his separation of employment. This shows Ridley never returned the 
LaCie drive as Ridley claimed, or that Ridley copied the Ecolab files to more than one USB drive, 
or another electronic source, before he allegedly returned the LaCie drive. 

24. The other two Ecolab files that I could not find on the Digital Guardian report raise 
another concern. Both of these files existed in a folder named “Nalco Water Files\Account 
Mangement Examples.” Because these two files appear not to be included in the Digital Guardian 
report, this strongly suggests to me that Ridley exfiltrated even more Ecolab files than was 
previously known. It is apparent that Ridley had access to these files as well during his 


employment at ChemTreat. 
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25. On page 13 of the Vaughn report, Vaughn claims to have validated the CrowdStrike 


? oe 


report’s “accuracy in logging (1) the serial number of external USB devices connected to a laptop”. 
However, nowhere in Vaughn’s report or the CrowdStrike report is any reference to the makes, 
models and serial numbers of the USB drives Vaughn earlier identified as USB drives 
“HarddiskVolume5” and “HarddiskVolume6” notwithstanding the fact that Vaughn identified 
Ridley accessing known exfiltrated Ecolab files from these two mystery USB drives. 

26. Why has Ridley not returned the two USB _ drives referenced as 
“Harddisk Volume5” and “HarddiskVolume6” in the CrowdStrike report? Why has Vaughn not 
imaged and analyzed the USB drives referenced as “Harddisk Volume5” and “Harddisk Volume6” 
in the CrowdStrike report? How is it possible to rely upon the completeness and accuracy of the 
CrowdStrike report as Vaughn claims given the fact that basic information such as these two USB 
drives’ makes, models and serial numbers are nowhere to be found in the CrowdStrike report? 

Missing Analysis of Ridley’s 2"! ChemTreat Laptop 

27. | Vaughn’s report is missing any reference to the analysis of Ridley’s usage of 
personal email accounts and cloud file storage accounts on the second Ridley ChemTreat laptop. 
I will require a forensic image of this second ChemTreat laptop in order to perform the 
aforementioned analysis. Vaughn’s report omits the make, model and serial number of this second 
laptop and also omits any reference as to the specific date this second laptop was provided to 
Ridley, nor any explanation of why a CrowdStrike log capturing actions performed by Ridley 


using this second laptop was not preserved nor analyzed nor produced. 


No Explanation of How Ridley Personal Files Were Transferred 


to ChemTreat’s Systems by Ridley 
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28.  Vaughn’s report, page 10, states that “I conducted a search of Mr. Ridley’s 
OneDrive documents. The details of that search are discussed below. The search did not reveal 
any documents that appeared to contain Ecolab’s confidential information. Instead, many of the 
documents returned as a result of my investigation of Mr. Ridley’s OneDrive were clearly 
ChemTreat documents, and the remainder were either Mr. Ridley’s personal documents or 
documents that did not bear indicia that they belonged to Ecolab." 

29. | Vaughn’s report omits any indication of how Ridley’s “personal documents” were 
placed into Ridley’s ChemTreat OneDrive account by Ridley. The CrowdStrike report certainly 
does not contain any such information, which is why it is my opinion that the CrowdStrike report 
alone cannot be relied upon to have captured all of Ridley’s potential interactions with Ecolab 
files, Ridley’s personal files or ChemTreat files Ridley created using exfiltrated Ecolab 
information. Did Ridley access, as I believe, his personal Microsoft account and then copy the 
“personal files” Vaughn references to his ChemTreat OneDrive account? Did Ridley upload the 
“personal files” to his ChemTreat OneDrive account from an external USB drive connected to the 
now wiped ChemTreat laptop? The Vaughn report omits any reference to the names of the 
“personal files” Vaughn discovered, nor any reference as to how these “personal files” were placed 
on ChemTreat’s systems by Ridley. 

30. | How did Vaughn conclude that his "search did not reveal any documents that 
appeared to contain Ecolab’s confidential information’? I do not see any reference in the Vaughn 
report related to Vaughn having run key term searches based upon the dozens of exfiltrated Ecolab 
customer names identified in the Digital Guardian report. Nor do I see any reference to Vaughn 


analyzing the actual contents of documents created by Ridley while Ridley was employed at 
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ChemTreat to determine if Ridley simply copied and pasted information from Ecolab files to files 
Ridley created at ChemTreat. 
Missing Analysis of Ridley Colleagues’ ChemTreat Workstations 

Si Also conspicuously absent from the Vaughn Report is any information regarding 
the forensic imaging and analysis of Ridley’s colleagues’ ChemTreat workstations, specifically in 
regards to the usage of external USB drives, including interacting with any Nalco files stored on 
external USB drives, or any analysis of Ridley’s colleagues’ interaction with personal email 
accounts and personal file storage accounts. 

32. In addition, it appears that Vaughn did not interview or speak with Mr. Ridley to 
determine if he used or accessed any Ecolab files or information during his employment at 
ChemTreat, or if Ridley shared any Ecolab files or information with anyone at ChemTreat. 

a3: Similarly, Vaughn did not interview or speak with any of the ChemTreat custodians 
whose files Vaughn searched to determine their individual document management and storage 
practices. Specifically, these individuals could be storing Ecolab files on their local ChemTreat 
laptop hard drives, or within personally controlled USB drives, email accounts; cloud file storage 
accounts, and home computers. However, Vaughn specifically excluded the aforementioned data 
sources and accounts completely from his report. 

Missing Analysis of Ridley’s ChemTreat Wiped Workstation Backups 
to ChemTreat Servers 

34. — Itis common for large organizations to backup employees’ workstations’ entire “C” 
drives, or at a minimum, backup employees’ workstations’ “Desktop”, “My Documents” and “My 
Downloads” folders to a company server in the event a given employee’s workstation is lost or 


stolen. It is common for large organizations to run virtualized desktops on employees’ 
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workstations, in which case it is necessary to image a copy of the targeted workstation’s virtual 
computer hard drive stored on a company server. Vaughn’s report omits any reference to 
identifying or analyzing any such ChemTreat network stored backups of Ridley’s wiped 
ChemTreat workstation. 

Missing Analysis of Ridley Personal Devices and Accounts 

35. | Most conspicuously absent from the Vaughn Report is any information regarding 
the forensic imaging and analysis of Ridley’s personally owned devices and accounts. 

36. | We know for certain that Ridley exfiltrated Ecolab files to his personal Microsoft 
account and interacted with some of those exfiltrated files while employed at ChemTreat. 

37. Forensic analysis of Ridley’s personal computers, smartphones, email accounts and 
cloud storage accounts could reveal significant interaction with the exfiltrated Ecolab files while 
Ridley was employed at ChemTreat. 

Missing Ridley Activity 

38. | Vaughn’s report confirms that the date range of human activity captured by the 
CrowdStrike report ranges from July 9, 2021 through February 28, 2022!. I have been informed 
that Ridley began employment with ChemTreat on July 2, 2021 and ended employment with 
ChemTreat on March 18, 2022. Therefore, the CrowdStrike report is missing human activity for 
the time period July 2, 2021 through July 8", 2021 and the time period February 29, 2022 through 
March 18, 2022 (“Missing Time Period”’). 

39. J am unclear if Vaughn and ChemTreat’s counsel is representing that Ridley 
performed no work whatsoever on behalf of ChemTreat during the Missing Time Period, or simply 


that the CrowdStrike report itself was not run to include the Missing Time Period. 


' Vaughn Declaration page 36 Section 1 “Temporal Ranges of the CrowdStrike Log”. 
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40. It is also unclear to me from the Vaughn Report or any other information I have 
been made aware of if ChemTreat preserved or searched their Office365 Universal Audit Log’, 
which captures all human activity related to the usage of company email accounts, company Teams 
chat, OneDrive file interaction and SharePoint file interaction. Searching and analysis of 
ChemTreat’s Office365 Universal Audit Log for the time period July 2, 2021 through March 18, 
2022 could have revealed evidence of Ridley interaction with exfiltrated Ecolab information. 

41. | Vaughn’s report states that “Mr. Ridley did not receive his first ChemTreat-issued 
laptop until July 12, 2022 at the earliest.” If this is true, and Ridley was in fact performing work 
on ChemTreat’s behalf prior to July 12, 2022, it stands to reason that Ridley must have been 
performing work on ChemTreat’s behalf using one or more personally owned devices for the time 
period July 2, 2021 through July 12, 2021. It is disconcerting and inexplicable that Ridley’s 
personal devices and accounts have been omitted completely from the Vaughn report. 

Vaughn’s Confirmation That Ridley Accessed 


Nalco Water Files Using the Wiped ChemTreat Laptop 


42. Vaughn confirms that Ridley was accessing Nalco files stored in a folder named 
“Nalco Water Files” from two different external USB drives on August 17, 2021, August 20, 2021 
and January 28, 2022. Omitted from Vaughn’s report is any indication of imaging and analyzing 
the two USB drives used by Ridley which clearly contained Nalco files. 

43. Also omitted from Vaughn report is the makes, models and serial numbers of these 


two USB drives because the CrowdStrike omits this critical information! 


” https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-search? view=0365-worldwide 
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44. Vaughn has confirmed my declaration’s findings that Ridley continued to have 
access to his Nalco files and interact with his exfiltrated Nalco files as recently as January 28, 
2022. 

45. In order for one to be sure that Ridley did not copy and paste information from any 
of the exfiltrated Nalco files, I will require a copy of Ridley’s complete ChemTreat email account 
contents and Ridley’s complete ChemTreat OneDrive files. 

Vaughn Report Omits Any Reference to 


Ridley’s Personal Microsoft Account 


46. Notwithstanding the fact that the CrowdStrike report, CHEMR-000002195.xml, 
captured Ridley accessing his personal Microsoft account by visiting the website 
“cdn.odc.officeapps.live.com” on 2021-10-30 T21:20:51.298+0000 (UTC), less than one minute 
before accessing an “Arnold’s Airforce Base” folder within Ridley’s ChemTreat OneDrive 
account, Vaughn does not address any evidence originating from or related to Ridley’s personal 
Microsoft account. This omission is especially glaring to me as ChemTreat themselves fired 
Ridley for emailing a Nalco file from Ridley’s personal Microsoft account to his ChemTreat email 
account. 

47. As I stated in my initial report, it is my opinion that Ridley was accessing Ecolab 
documents from his personal Microsoft account while he was employed at ChemTreat and 
concurrent with his usage of the now wiped ChemTreat laptop. In fact, Vaughn confirmed that 
Ridley used external two different USB drives to access Ecolab files using the now wiped 
ChemTreat laptop. It is my understanding that these USB drives have not been imaged nor 


produced in discovery. 
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48. Also, in my extensive experience, employees like Ridley will change file names if 
they transfer files from their prior employer to their new employer. Thus, again, the only way to 
be sure Ridley did not transfer or use Ecolab information while employed at ChemTreat, including 
the creation of documents for ChemTreat using information taken from Ecolab files, is for me to 
analyze all the files Ridley created while employed at ChemTreat. This would include reviewing 
documents Ridley saved to his ChemTreat OneDrive account. I would also want to review 
Ridley’s ChemTreat computer, but since that has been wiped, this analysis is likely impossible 
unless ChemTreat had backed up the wiped laptop as virtual device to a ChemTreat server. 

Ridley Business Plan Document Produced as CHEMR-000000278.XLSX 

49. Forensic analysis of CHEMR-000000278.xlIsx, which was produced from Clay 
Cissell’s ChemTreat email account, reveals the fact that CHEMR-000000278.xIsx was originally 
created by Michael Chmelovski, using a Nalco Company Microsoft Excel license on October 1, 
2015. 

50. | Vaughn’s report does not identify nor address this Nalco file. I am not sure why 
Vaughn’s analysis of the Ridley sources Vaughn identified in his report did not uncover CHEMR- 
000000278.xIsx given the fact that CHEMR-000000278.xIsx was clearly created originally using 
a Nalco computer, is Nalco’s property and is one of many concrete examples of Ecolab files 
exfiltrated by Ridley and later used while employed at ChemTreat. 

51. It is possible that Vaughn did not search all sources simply for the term “Nalco” 
and thus did not uncover CHEMR-000000278.xIsx in his searches. Failure to find this document 
is inconsistent with the methodology outlined in Vaughn’s report. 

52. Thus, a forensic analysis of all metadata embedded within all email attachments 


sent by Ridley using his ChemTreat email account and personal Microsoft account, in addition to 
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a forensic analysis of all metadata embedded within all files contained within Ridley’s ChemTreat 
OneDrive account is required to confirm whether Ridley simply saved additional Ecolab files with 
new names to ChemTreat’s systems. 
Omission of Exfiltrated Ecolab Contacts 

53: Notwithstanding the fact that, according to the Digital Guardian report, Ridley 
exfiltrated a list of Ecolab contacts, and ChemTreat’s lawyers admitted this?, Vaughn’s report 
makes no reference to either the exfiltrated Ecolab contacts file or the contents of the exfiltrated 
Ecolab contacts file. My original report identified the fact that Ridley deleted a file named “Ridley 
Contacts.CSV” from a USB drive serial number 0416080000012762 on 02/09/2022, which 
underlines the fact that Ridley was in possession of his former Ecolab contact information up until 
at least February 9, 2022. 

No Reference to The AmazonBasics USB Drive 
Connected to the ChemTreat Laptop 

54. Notwithstanding the fact that the CrowdStrike report identified an AmazonBasics 
USB drive being connected to the now wiped ChemTreat laptop on July 9", 2021, Vaughn’s report 
does not address this USB drive at all. This drive must be imaged and analyzed in order for all 
parties to understand what files were contained on that drive and how those files were interacted 


with. 


No Analysis of Deleted Files 


35: The Vaughn report omits any analysis of deleted files which may have existed on 


the wiped Ridley ChemTreat laptop, or Ridley’s personal devices, or any of the multiple USB 


3 T have been informed that ChemTreat counsel admitted that Ridley exfiltrated contacts from his Ecolab account. 
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drives Ridley connected to the ChemTreat laptop and containing Nalco water files as captured in 
the CrowdStrike report. 
56. If the wiped Ridley ChemTreat laptop was backed up to ChemTreat systems as I 
suspect, then analysis of those backups should include analysis of deleted files. 
Sources of Evidence I Require To Fully Respond to 


and Rebut the Vaughn Report 


57. The following sources of evidence have not been made available to me as of the 
date of the publication of this rebuttal: 

a. Ridley’s personally owned computers, smartphones, USB devices, 
LinkedIn account, email accounts and cloud storage accounts. 

b. Ridley’s colleagues’ ChemTreat workstations, USB devices, personal 
computers, smartphones, personal email accounts, or personal cloud file storage accounts. 

C: Any of the sources Vaughn analyzed with the exception of the CrowdStrike 
log and detailed on Pages 9, and Pages 27-28. 

d. Emails contained in the ChemTreat Microsoft (0365) email system for 
Anthony Ridley for the period May 1, 2021 to March 16, 2022 (including emails that may 
have been deleted on or after February 9, 2022, when Ecolab alerted ChemTreat to Mr. 
Ridley’s alleged misappropriation) 

6; All OneDrive documents uploaded by or accessible to Mr. Ridley during 
his employment by ChemTreat (including OneDrive documents Mr. Ridley may have 
deleted on or after February 9, 2022) 

i. The first laptop issued to Mr. Ridley by ChemTreat. 


g. The second laptop issued to Mr. Ridley by ChemTreat 
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h. The USB device returned to ChemTreat by Mr. Ridley upon his termination. 
i Any backups of the wiped ChemTreat laptop stored on ChemTreat servers. 
ie Mr. Ridley’s ChemTreat-provided cell phone. 


k. Mr. Ridley’s ChemTreat emails. 


L. All documents accessible to Mr. Ridley via OneDrive. 
m. File names of all documents accessible to Mr. Ridley via SharePoint. 
n. Emails of the following custodians for the temporal period July 1, 2020 


through April 1, 2022: Tyler Bates, John Alcorn, Clay (Richard) Cissell, Albert DeNunzio, 
David Ellis, Larry Harmon, Matthew Hofer, Michael (Todd) Kraft, Steven Leavell, David 
Pearson, James (Jim) Shealy, George Sloan, and John Spalding. 
oO. All documents accessible to the following custodians via OneDrive as of 
March 16, 2022: Tyler Bates, John Alcorn, Richard (Clay) Cissell, Albert DeNunzio, Larry 
Harmon, Matthew Hofer, Michael (Todd) Kraft, Steven Leavell, David Pearson, James 
(Jim) Shealy, George Sloan, and John Spalding. 
p. Mr. Ridley’s Lexar USB device issued to him by ChemTreat. 
q. The missing and unaccounted for missing USB drives referenced in the 
Vaughn report and the CrowdStrike report. 
Conclusion 
58. For all the reasons discussed above, Vaughn’s search methodology was 
significantly deficient in my opinion and not reasonable at all in my opinion. Ridley’s personal 
devices and accounts were not searched at all. The multiple USB drives Ridley used to access 
Nalco files using his ChemTreat laptop were not imaged nor searched at all. Vaughn’s analysis 


did not uncover the exfiltrated CHEMR-000000278.xIsx business plan file which contained the 
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term “Nalco” in embedded metadata. The search terms Vaughn used by Vaughn were far too 
narrow. Rather than simply running search terms based upon specific file names, he should have 
run related search terms such as “Fact Packs”, and the fifty to sixty Ecolab customer names related 
to exfiltrated files and found in the Digital Guardian report, such as “Arnold’s Airforce Base.” 
Vaughn also excluded analysis of stand-alone devices from his work. It appears Vaughn did not 
interview Mr. Ridley or the other custodians. 

59. | Nowhere in Vaughn’s report is any indication or accounting of Ridley’s activities 
during the time periods omitted from the CrowdStrike report including the critical first ten days of 
Ridley’s employment with ChemTreat! 

60. I completely disagree with Vaughn’s opinion that the CrowdStrike report somehow 
replaces or obviates the need for the now wiped ChemTreat laptop; this could not be further from 
the truth. The wiped laptop would have provided me as a forensic investigator a complete view 
of what files Ridley was uploading, downloading, printing, and interacting with. Unlike the Digital 
Guardian report which contains a complete and exhaustive listing of Ridley’s human interaction 
with Ecolab files during Ridley’s last few weeks of employment, the CrowdStrike report only 
shows a portion of such activity. The CrowdStrike report, which is a malware analysis tool, does 
not in any way equate to the comprehensive Digital Guardian data loss prevention (“DLP”) report. 

61. In order for me to complete my analysis, I will need access to the sources listed 
above, especially the sources identified in the Vaugh report pages 27-28. I reserve the right to 


supplement this report upon receipt of these sources and adequate time to analyze them. 
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Dated: March 20, 2022 


Respectfully submitted, 


astra DO. Til, 


Laurence D. Lieb 
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EXHIBIT A 


MCFE — AXIOM CERTIFICATION IS AWARDED TO: 


Laurence Lieb 


In recognition of expert use of Magnet Forensics’ Magnet AXIOM digital forensics software 
and understanding of the core concepts of digital examinations. 


10/20/2022 13:38:06 +00:00 2 years from the Date of Issue W 


DATE OF ISSUE DATE OF EXPIRY AUTHORIZED BY CHARLES COBB, VP of TRAINING 


Magnet Forensics 2250 Corporate Park Drive, Herndon, VA 20171 www.magnetforensics.com 
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EXHIBIT B 


Laurence Lieb 


Has fulfilled the requirements set forth by BlackBag Technologies, and is therefore officially 
recognized as a 


Certified BlackLight Examiner 


This certification is being awarded to Laurence Lieb on 05/07/2020 
for the successful completion of the 16 hour Digital Forensic Basics course and written certification 
exam. This CBE certification shall remain current and effective for 3 years from this date. 


TECHNOLOGIES Matt McFadden 


Ken Basore Director | Training 


CEO | BlackBag Technologies 


Boar &} BlackBag: a 
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EXHIBIT C 


Laurence D. Lieb 
CEO, President Tyger Forensics Inc., 
53 W. Jackson Blvd. Suite 609, Chicago, Illinois 60604 
Michigan Private Investigator License #3701207106 


EMAIL: SUPPORT@FORENSICS.ONE 
TEL: 312.613.4240 


TECHNICAL EXPERTISE 


Systems: Windows, Windows Servers, Microsoft Exchange, Lotus Notes, Linux, OS X, iOS, Android, 


Windows Phone, Blackberry 


Software: Magnet Forensics Axiom, Digital Inspector, Cellebrite UFED 4PC, Cellebrite Physical Analyzer, 
Forensic Explorer, Passmark OSForensics, FIK Imager, MOBILedit Forensic, Elcomsoft Phone Breaker 
Forensic, Aid4Mail Forensic 


TESTIMONY 


I have been offered as an expert witness and testified at hearing, or by affidavit or declaration in the following 


Cases: 


e Testimony provided December 29, 2022 in a matter captioned BGC Partners, Inc. et al v. Avison 


Young (Canada), Inc. et al, CIVIL DOCKET FOR CASE #: 2:15-cv—00531—RFB-—E], Judge 


Richard F. Boulware, H. Hired by Tina Solis of Nixon Peabody. 


e Testimony provided January 10, 2022 in a matter captioned People of the State of Michigan v. 
Stephen Mark Ricketts, Circuit Court # 19-02774-FH, District Court # D1900653, Case # 41-19- 
002109-99, Judge Christina Elmore. Hired by Andrew John Rodenhouse of Rodenhouse Law 


Group. 
e Testimony provided August 17, 2021 at a University of Maryland, Division of Student Affairs, The 


Office of Student Conduct hearing, Case Number 2020329902. Hired by Defendant counsel David 


Eagle of Klehr Harrison Harvey Branzburg LLP 
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v. Avison Young (Canada) Inc. Et al Case No 2015-L-2186. Circuit Court of Cook County Illinois 
County Department Law Division. Hired by Plaintiff counsel Nixon Peabody LLP. 

e Sworn testimony provided March 22™ 2019, in a matter captioned Newmark Group Inc. Et al, v. 
Avison Young (Canada) Inc. Et al Case No 2015-CA-1028B. Superior Court of the District of 
Columbia, Civil Division. Hired by Plaintiff counsel Nixon Peabody LLP. 

e Sworn testimony provided February 28", 2019 through March 1*, 2019 at Trial in a matter captioned 
LovePop, Inc. v. PaperPop Cards, Inc. Civil Action No. 1:17-cv-11017. Hired by Defendant 


PaperPop counsel Jaye Quadrozzi of Young & Associates. 


e Sworn testimony provided November 29, 2018 in a matter captioned LovePop, Inc. v. PaperPop 
Cards, Inc. Civil Action No. 1:17-cv-11017. Hired by Defendant PaperPop counsel Jaye Quadrozzi 


of Young & Associates. 


e Sworn testimony provided May 31, 2018 in a matter captioned In RE the Marriage of Jose Betanzos, 
Petitioner, And Manuela Correa, Respondent, No. 18 OP 70489 consol. w/18 D 2149 Cal. C. 
Circuit Court of Cook County, Illinois, County Department Domestic Relations Division. Hired by 


Caitlin Cervenka, LAF. 


e Sworn testimony provided April 17, 2018 in a matter captioned Marcus J Moore v. Annette Ambriz. 
Case No. 20180 P000542. State of Ilinois, Lake County, Nineteenth Judicial Circuit, Domestic 
Violence Courthouse. Hired by Respondent’s counsel Jennifer Payne of the Legal Assistance 


Foundation of Chicago. Designated as an expert by the Honorable Judge Diane E. Winter. 


e Sworn testimony provided October 27, 2017 in a matter captioned Juana Luna v. Jose Rodrigo 
Cabrera. Case No. 17 OP 75249. State of Illinois, Circuit Court of Cook County, Domestic 
Violence Courthouse. Hired by Claimant’s counsel Caitlin Cervenka of the Legal Assistance 


Foundation of Chicago. Designated as an expert by the Honorable Judge Judith C. Rice. 


e Sworn testimony provided April 15th, 2016 in a matter captioned, Stacey Verhil v. Frank Marchese. 
Case No. 14-03159-DM. Kent County Courthouse, Grand Rapids Michigan. Hired by Plaintiffs 
counsel Tara Velting of Garan Lucow Miller P.C. Designated as an expert by the Honorable Judge 
Kathleen A. Feeney. 
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e Sworn testimony provided August 7th, 2015 in a matter captioned, Stacey Verhil v. Frank Marchese. 
Case No. 14-03159-DM. Kent County Courthouse, Grand Rapids Michigan. Hired by Plaintiffs 
counsel Tara Velting of Garan Lucow Miller P.C. Designated as an expert by the Honorable Judge 


Kathleen A. Feeney. 


e Sworn testimony provided November 13th, 2014 in a matter captioned, Goken America, LLC, 
Plaintiff v. Naveen Kumar Bandepalya, Cresttek, LLC, & American Hydrostatics Distribution, Inc. 
Defendants. 12:14CV1445 U.S. District Court, $.D. of Ohio, Eastern District. Hired by 


Defendants’ counsel Frederick D. Elias of Ellias & Elias, P.C. 


e Sworn testimony provided July 11, 2013 in a matter captioned, Samson Lift Technologies, LLC 
versus JERR-DANN Corporation, a/k/a JERRDANN Corporation and Oshkosh Corporation, 
Index Number 653586/2011, New York County Supreme Court. Hired by Defendant’s Counsel 


Daniel T. Flaherty, Esq., Godfrey & Kahn 


EXPERT WORK 


e GHSP, Inc. V Arthur Hazen Sills, United States District Court for the Western District of Michigan, 


Southern District. Case No. 1:21-cv-218. Hired by Amanda Narvaes of Drew Cooper & Anding. 


e CCC Information Services Inc. v First Rate Excavate Inc., United States District Court, District of 
South Dakota Souther Division. Case CIV 21-4068. Hired by Timothy Hardwicke of GoodSmith 


Gregg and Unruh. 


e =©Mesirow Financial Holdings Inc. v Hart 353 North Clark LLC. Circuit Court of Cook County, 
Illinois, County Department, Chancery Division. Case No. 2021CH01591. Hired by John Grady of 
Grady Bell LLP 

e LM Construction Co., LLC v 5th & Deer Springs LLC District Court Clark County Nevada, Case 
No. A-19-797928-C. Hired by Mark Bourassa, The Bourassa Law Group. 

e Detroit Welded Tube LLC v Consolidated Metals Inc. United States District Court Eastern District 
of Michigan. Hired by David Hansma, Seyburn Kahn. 

e Hino Motors Manufacturing U.S.A. Inc, v. Chris Hetman et al. United States District Court for the 
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Phillips. 
e John Doe v. Ava Whitney Blige et al. District Court Clark County Nevada. Case No: A-21-828077-B 
Department 11. Hired by Louis Palazzo, Esq., Palazzo Law Firm. 


e SecureNet Technologies LLC v. Andrew Wilson and John Does 1-25, The Fourth Judicial District 


Court Utah County No. 200300026. Hired by Michael K. Green, Cowdell & Woodley P.C. 


e Trustees of International Union of Painters and Allied Trades District Council 711 Health & Welfare 
Pund et al v. FCS Group, LLC. New Jersey Court Case Number: 1:21-cv-10120. Hired by Steven J. 


Bushinsky, Esquire O'Brien Belland & Bushinsky LLC. 


e Maya Pettaway v John Cleland and Wyoming City Pizzeria Inc.. State of Michigan in the 17 Circuit 
Court. Case No. 19-06505-CZ. Hired by Andrew Rodenhouse, Esq., Rodenhouse Law Group P.C. 

e Peak6 NFS Holdings LLC, National Flood Services Holdings LLC, and National Flood Services LLC 
v AON USS. Holdings, Inc. and AON Corporation. In the Court of Chancery of the State of 
Delaware. C.A. No. 2020-0849-AGB. Hired by Timothy Hardwicke, Goodsmith, Gregg and Unruh. 

e CBRE, Inc. v Kathryn Tiernan. JAMS Arbitration Case No. 1340018099. Hired by Timothy 
Hardwicke, Goodsmith, Gregg and Unruh. 

e = Alphacard Systems LLC et al v Fery LLC. Case # 3:19-cv-20110. New Jersey District Court. Hired 
by Timothy Hardwicke, Goodsmith, Gregg and Unruh. 

e =Kathleen Quinn v Auto Injury Solutions Inc. Case No. 20-cv-1966. United States District Court 
Northern District of Illinois. Hired by Timothy Hardwicke, Goodsmith, Gregg and Unruh. 

e George Spencer et al v Kuldeep Malik et al. C.A. No. 2020-0609-JTL In the Court of Chancery of 
the State of Delaware. Hired by David Eagle, Klehr Harrison Harvey Branzburg LLP 

e BMO Harris Bank, NA v Jerry Lumpkins. United States District Court for the Northern District of 
Illinois Eastern Division Case: 1:20-cv-05642 Hired by Jason Hirsch, Esq. Levenfeld Pearlstein. 

e Axion RMS LTD. V UCP Seguin of Greater Chicago Foundation et al. Circuit Court of Cook 


County Illinois. Case No 2019 L 001168. Hired by Jason Hirsch, Esq. Levenfeld Pearlstein. 


e Capricorn Management Systems Inc. v. Government Employees Insurance Company and Auto 
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Division. Case N. 2:15-cv-02926-DRH-SIL. Hired by Timothy Hardwicke, Goodsmith, Gregg and 


Untuh. 


e Frederick Kaegi, Claimant, and Columbia Wanger Asset Management, LLC & Ameriprise Financial, 
Inc., Respondents. AAA Case No. 01-18-0000-0820. Hired by Michael Shakman, Miller Shakman, 


Miller Shakman and Beem. 


e Shaun Dilday v. James Bennett HI. Maricopa County Superior Court Cause No. CV2017-014621. 


Hired by Karen Karr, K. Leone Karr Law Office. 


e LovePop, Inc. v. PaperPop Cards, Inc. United States District Court, District of Massachusetts. Civil 
Action No. 1:17-cv-11017. Hired by Jaye Quadrozzi, Young and Associates P.C. 
e Courtney Taul-Reed v. Lexington Women’s Health, PLLC. Commonwealth of Kentucky Fayette 


Circuit Court 9 Division. Civil Action No. 14-CI-02792. Hired by James Smith, Gazak Brown. 


e Regina Andrew Design, Inc. v. Eric Magun. United States District Court for the Easter District of 
Michigan, Southern Division, Case No. 18-CV-10091-LJM-DRG. Hon. Laurie J. Michelson. Hired 


by Fatima Bolyea, Mantese Honigman. 


e People of the State of Michigan v. Todd Courser. Lapeer County Circuit Court, State of Michigan. 
Case No. 17-013022-FH. Hon. Nick O. Holowka. Hired by Sarah Howard, Pinsky Smith, Fayette & 


Kennedy, LLP. 


e Peter M. Peer, II, D.O. v. West Shore Medical Center. United States District Court, Western District 
of Michigan Southern Division, Case No. 1:17-cv-72. Hon. Paul L. Maloney. Hired by John 


Lichtenberg, Rhoads McKee. 


e Schmalz, Inc. v. Better Vacuum Cups, Inc. United States District Court, Eastern District of 
Michigan, Southern Division Case No. 16-10040. Judge Gershwin A. Drain. Hired by Dean 


Amburn, Dean Amburn Law, PLLC 


e Cover Crop Shop, LLC v. Isaac Weber. Court of Mercer County, Ohio Civil Division, Case No. 16 


CIV 069. Judge Jeffrey R. Ingraham. Hired by Victor A. Veprauskas, Lambert Leser. 


e David Grubb and Kristina Grubb, Claimants /Counter-Respondents v. Forest Ridge Construction, 


Inc. Arbitrator: Ronald Strote. Hired by Mark Nasr, Clark Hill PLC 
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e Lowell Construction Management, LLC and 4625 SECOND, LLC, v. David Cieszkowski. Case No.: 


16-002129-CB. Hon. Brian R. Sullivan. Hired by Kaveh Kashef, Clark Hill PLC . 


e Stephen E. Slaga v. Total Health Care, Inc. and Universal Health Management Co. State of Michigan, 
Wayne County Circuit Court Civil Action No. 16-009942-CL Hired by Michael L. Pitt (P24429) Pitt 


McGehee Palmer & Rivers, PC. 


e James W. Flinchbaugh v. Lean Learning Center Inc. and William Artzberger, Angelo J. Carlino and 
James Flinchbaugh Counter Defendants. State of Michigan, Circuit Court County of Oakland 
Michigan. Case No. 2016-151196-CB. Judge James M. Alexander. Hired by Brian H. Rolfe (P52680) 
Kemp Klein Law Firm. 

e Melisa Mays et. al. Class Action v. Governer Rick Snyder, City of Flint et. al., United States District 
Court, East District of Michigan 2:15-cv-14002-JCO-MKM. Hired by Michael L. Pitt (P24429),Pitt 
McGehee Palmer & Rivers, PC. 

e PCM, Inc. v. B2B Computer Products, LLC d/b/a ITsavvy. Hired by Katie M. Connolly, Nilan 
Johnson Lewis 

e Constance Bryant v. Moh7ammad Benammar et. al., Court No. 15 L 394, Claim N. 
63CBLG14003111. Hired by Anam Rodrguez, Shams, Rodgriguez & Mozwecz, P.C. 

e The Primadonna Company, LLC v. The Westmark Group, Inc. District Court Clark County Nevada 
Case No. A-15-722892-B Dept. XIII. Hired by Jeremy R. Kilber (10643), Weil Drage 

e =Robert L. Drummond v. Hartford Fire Insurance Company. U.S. District Court District of 
Connecticut. Civil N. 3:14-cv-0183-AWT. Hired by Jason T. Brown, JTB Law Group, LLC 

e Sylvia Magdeleno v Rico Enterprises, Inc. U.S. District Court District of Arizona Case No. 2:15-cv- 
00364-SRB. Hired by Karen L. Karr (014501) Clark Hill PLC 

e Senderra Rx Partners, LLC v. Denay R. Loftin and Elizabeth Naylor. U.S. District Court Eastern 
District of Michigan Southern Division. Case No. 2:15-cv-13761-AC-RSW. Magistrate R. Steven 


Whalen. Hired by Paul A. Wilhelm Clark Hill PLC. 


e =Vulpina, LLC v Randy K. Dzierzawski and Kimberly Dzierzawski. U.S. Bankruptcy Court Eastern 
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Turco, Brooks, Wilkins, Sharkey & Turco PLLC 
e Laura Sacha-Staskiewicz v. Metropolitan Health Corporation and Micahel Faas. State of Michigan 
Circuit Court for the County of Kent. Case No. 15-02809-CKB. Hon. Christopher P. Yates. Hired 


by Jason Thompson, Sommers Schwartz P.C. 


e@ Jeanne L. Fox v The Michigan Department of Technology Management and Budget, et. al. State of 
Michigan. Case No.: 14-857-CD Circuit Court County of Ingham. Hired by Aaron L. Davis 
(P77406) Fraser Trebilcock Davis & Dunlap, P.C. 

e Sierra Development Co. d/b/a Club Cal Neva. v. Chartwell Advisory Group, Ltd. U.S. District 
Court District of Nevada. Case No. 3:13-cv-00602-RFB-VPC. Hired by Scott L. Hernandez 
Robison, Belaustegui, Sharp & Low. 


e IPOX Schuster, LLC v. Nikko Asset Management Co. Ltd. And Lazard Asset Management LLC. 


USS. District Court Northern District of Ilinois Eastern Division Civil Action No. 15C9955. Hired 


by Aaron Charfoos of Dykema Gosset PPLC 


e Weatherford International, LLC v. Michael McKeachnie et al. U.S. District Court District of 
Colorado Case No. 1:15-cv-01320-MSK-KLM. Hired by Christopher D. Kratovil Dykema Gossett 


PLLC 


e In re Country Stone Holdings, Inc. Debtor. U.S. Bankruptcy Court Case No. 14-81854. Hired by 


Dante Stella Dykema Gossett PLLC. 


e = =Mike Kidd v. Krave Group, LLC et al. U.S. District Court Northern District of Texas Fort Worth 


Division Case 4:15-cv-00679-Y. Hired by James C. Gordon Gordon & Sykes, LLP 


e Inthe Matter of Trinity Capital Corporation (D-3320), Securities and Exchange Commission, 
Denver Regional Office. Hired by Edward F. Malone, Esq. of Barack Ferrazzano Kirschbaum & 


Nagelberg LLP. Case No.: 14-857-C Hon. James S. Jamo 
e Rachel Edelshteyn v. Stephen Calabrese, 150P70020. Hired by Liz Ptacek Supervising Attorney — 
Advocacy, Domestic Violence Legal Clinic, State of Hlinois, Circuit Court of Cook County, 


Domestic Violence Courthouse. 
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Advocacy, Domestic Violence Legal Clinic, State of Hlinois, Circuit Court of Cook County, 


Domestic Violence Courthouse. 


e Tina Atkinson, Grace Bonnie, Jessica Frazier, Florence Gianforte, Richard Hall, Rachel Marshall, 
Shelly Primus, and Karen Stout vs. Teletech Holdings, Inc., Teletech@home,Inc., and Kenneth 
Tuchman, United States District Court, Southern District of Ohio, Civ. No. 3:14-cv-00253-WHR. 


Hired by Matthew L. Turner, Esq., Sommers Schwartz, P.C. 


e Jasmine Lawrence, Individually and on Behalf of All Similarly Situated Individuals, v. Maxim 
Healthcare Services, Inc., 1:12-CV-02600-cab, United States District Court, Northern District of 


Ohio, Cleveland Division. Hired by Jason S. Thompson, Esq., Sommes Schwartz, P.C. 


e Tara A. Felty, v. Waupaca Foundry Inc. and Waupaca Foundry Inc. v. Stewart Industrial, Perry 
Circuit Court, State of Indiana, 62C011407-CT-344. Hired by Paul Benson, Esq., Michael Best & 


Friedrich. 


e Tri-State Generation et al v. Mitsubishi International Corporation et al, United States District Court, 


District of Arizona, 3:14-cv-08115-NVW. Hired by Benjamin Subin, Esq. Holland & Knight. 


e John Doe 1; John Doe 2; John Doe 3; John Doe 5; John Doe 6; John Doe 7 And Next Friend Of 
Minor John Doe 4, On Behalf Of Themselves And A Class Of All Others Similarly Situated, Vs. 
Michigan Department Of Corrections (‘Mdoc’”); Rick Snyder, Governor Of The State Of Michigan; 
Daniel H. Heyns, Director, Michigan Department Of Corrections; Thomas Finco, Deputy Director 
Of Mdoc Correctional Facilities Administration; Dennis Straub, Former Deputy Director Of Mdoc 
Correctional Facilities Administration; Randy Treacher, Chief Deputy Director Of Mdoc 
Correctional Facilities Administration; Willie Smith, Warden Of Carson City Correctional Facility; 
Heidi Washington, Warden Of Charles Egeler Reception And Guidance Center; Mary Berghuis, 
Warden Of Earnest C. Brooks Correctional Facility; Paul Klee, Warden Of Gus Harrison 
Correctional Facility;John Prelesnik, Warden Of Richard A. Handlon Correctional Facility; Cathleen 
Stoddard, Warden Of Richard A. Handlon Correctional Facility; Cindi S. Curtin, Warden Of Oaks 
Correctional Facility; David Bergh, Warden Of Thumb Correctional Facility; Jeffrey Woods, Warden 


Of Chippewa Correctional Facility;Robert Napel, Warden Of Marquette Branch Prison; And 
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Michigan, Circuit Court For The County Of Washtenaw. Hired By Deborah Labelle, Esq. 

e Carol A. Sedges v. St. Cloud Health Care Center, Inc. et al, Superior Court of New Jersey Law 
Division, Essex County, ESX-L-7298-12. Hired by John D. Coyle, Esq., LeClair Ryan. 

e United States of America v. Farid Fata, 2:13-mj-30484, United States District Court, Eastern District 
of Michigan. Hired by William H. Horton, Esq., Giarmarco, Mullins & Horton, P.C. 

e UPS Mail Innovations v. James Cuthbert. 2013CH001847. Circuit Court for the Eighteenth Judicial 


Circuit, DuPage County, Illinois. Hired by Quarles and Brady. 


e Huntington National Bank V. Timothy Weaver, Reneé Jerisk, Anthony Ciccarelli, Individuals,And 
Northpointe Bancshares, Inc. State Of Michigan Kent County Circuit Court. Hired By John M. 


Lichtenberg, Esq.Rhoades Mckee P.C. 


e Creative Foam Corporation v. Kurt Schloemp. 2014-140875-CK. State of Michigan, Circuit Court 
for the County of Oakland. Hired by Willam H. Horton, Esq. Giamarco & Mullins. 

e Nexteer Automotive v. Mando America Corporation. 13-021401-CK-1. State of Michigan, Circuit 
Court for the County of Saginaw. Hired by Willam H. Horton, Esq. Giamarco & Mullins. 

e Wilshire Vermont Housing Partners LP v. Taisei Construction Corporation et al. BC504178. 
Superior Court of the State of California, The County of Los Angeles. Hired by Thomas McNutt, 
Esq., Youngerman and McNutt. 

e Information Technology Customer Care, Inc. v. Stores Online, Inc. 090401169. Fourth Judicial 
District Court, Utah County, State of Utah. Hired by Blair R. Jackson, Esq. Invictus Law Firm. 

e North American Mechanical, Inc. v. Walsh Construction Company H, LLC. United States District 
Court, Eastern District of Wisconsin, Milwaukee Division. Hired by Joshua Levy, Esq., Crivello 
Carlson. 

e = Asyst Tech LLC v. Eagle Eyes Traffic Inc. Co. Ltd. 2:11-cv-00381. United States District Court, for 


the Eastern District of Wisconsin. Hired by Daniel T. Flaherty, Godfrey and Kahn. 


e Sharon Almonrode v. Sullivan Ward Asher Patton P.C. et al. 11-122425-CZ. State of Michigan, 


Circuit Court for the County of Oakland. Hired by Sullivan Ward Asher Patton P.C. 
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Hired by Jeffery B. Kaiser, Esq. Kaiser P.C. 


e MPT of Hoboken TRS, LLC v. HUMC Holdco, LLC. Court of Chancery of the State of Delaware. 
Hired by Wallace Showman of Ajamie. 

e Greg Sabanski v. Crystal Mountain Resort. 14-9904-NO. State of Michigan, Circuit Court for the 
County of Benzie. Hired by Scott D. Feringa, Esq. of Sullivan Ward Asher & Patton P.C. 

e Kleen Products LLC et al v. Packaging Corporation of America et al. 1:10-CV-05711. United States 
District Court, Northern District of Illinois. Hired by Mayer Brown. 

e Harold Talley and Jennifer Talley v. General Organics HC Inc. 13L007998. Circuit Court of Cook 
County Illinois, County Department, Law Division. Hired by Markel Service Incorporated. 

e = §=Maribel Torres v. Electro-Motive Diesel, Inc. Circuit Court of Cook County, Illinois, County 
Department, Law Division. Hired by Legal Assistance Foundation of Chicago. 


e ESTATE OF KATHRYN E. QUINLAN, by Timothy J. Schneider, its Personal Representative; 


e = Plaintiff; Vs.Mark E. Prince, M.D.; And Avraham Eisbruch, M.D.In Consolidation With: Estate Of 
Kathryn E. Quinlan, By Timothy J. Schneider, Its Personal Representative Vs.The Regents Of The 
University Of Michigan, D/B/A University Of Michigan Health System And University Of 
Michigan Medical Center;Case No. 11-0006-Mh. 11-24-Nh. State Of Michigan, Circuit Court For 


The County Of Washtenaw. Hired By Dale L. Hebert, Esq. Smith Haughey Rice & Roegge, P.C. 


e = § Miranda Jo Truitt et al, v. The Chicago School of Professional Psychology. BC495518. Superior 
Court of the State of California for The County of Los Angeles. Hired by Dean Dickie, Esq. Miller 


Canfield. 


e Jocelyn Lewis et al v. Lebanon Public Library. 1:13-cv-0445RLY-DKL. United States District 


Court, Southern District of Indiana, Indianapolis Division. Hired by Kighlinger and Grey 


EMPLOYMENT HISTORY 


August 2014 to Present — CEO and President, Tyger Forensics, Inc. 
January 2011 — May, 2016 — Chief Innovation Officer, Scarab Consulting 


November 2007 — January 2011 — National Director, Esquire Litigation Solutions 
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April 2003 — April 2006 — Owner, President, Eljah Technologies 


DIGITAL FORENSIC CERTFICATIONS 


e I became a Magnet Forensics Certified Examiner (MCFE) on October 20", 2022, following coursework, research and 


testing. 


I became a Cellebrite Certified Physical Analyst (CCPA) on December 1oth, 2021, following coursework, research and 


testing. 


I became a Cellebrite Certified Operator (CCO) on December 7th, 2021, following coursework, research and testing. 


I became a Certified BlackLight Expert (CBE) on May 6th, 2020, following coursework, research and testing. 


I became a Cellebrite Advanced Smartphone Analysis (CASA) Examiner on October 26> 2017, following coursework, 


research and testing. 


I became a Cellebrite Certified Physical Analyst (CCPA) on December 25, 2015, following coursework, research and 


testing. 


I became a Certified OSForensics Examiner (COSFE) as of November 25, 2015, following coursework, research and 


testing. 


T have been a Certified Blacklight Examiner (CBE) since October 20, 2015, following coursework, research and testing. 


I received Lantern Certified Examiner (LCE) status on June 12, 2014, following testing and studies. 


T have been a certified Forensic Explorer Examiner (FEXE) since completing the tests on September 12, 2014. 
EDUCATION 
B.A. in Japanese Studies, University of Illinois at Urbana-Champagne, Champagne, IL 


PROFESSIONAL MEMBERSHIPS 


Tam a ranking Senior Member of ForensicFocus.com, a digital forensics and electronic discovery portal. 
I am also a licensed private investigator in Michigan. My Michigan P.I. License number is #3701206704 


PROFESSIONAL AWARDS 


I was recognized in Legal Aid Chicago’s 2021 Annual Report for fifteen years of Pro Bono service. 
I was recognized as a “Champion of Justice 2016” by the Domestic Violence Legal Clinic. 
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PROFESSIONAL PUBLICATIONS 


I published a Continuing Legal Education class on employee turnover and forensic analysis best practices, 


currently accredited by bar associations in seventeen US. states 


I published a Continuing Legal Education class on theft of trade secrets best practices, currently accredited by 


bar associations in seventeen U.S. states 


I published a Continuing Legal Education class on smart-phone forensic best practices, currently accredited 


by bar associations in seventeen U.S. states. 


I published an article containing original computer forensic research findings on Microsoft Windows 8 on 


www.ForensicFocus.com. 


I published an article titled “Navigating the Sea of Change in eDiscovery Technology” at InsideCounsel.com, 


White Papers Section. August 2010. 


I published an article titled “When Dealing with Electronic Discovery, Don’t Be Afraid; Just Don’t Go 


Alone” in Thomson Reuters EDRM Quarterly Magazine. Spring 2009. 
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